Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

retroworks writes "Dinei Florencio and Cormac Herley write that cybercrime depleted gullible and unprotected users, producing diminishing returns (over-phishing). They argue that the statistics on the extent of losses from cybercrime are flawed because there is never an under-estimation reported. Do they underestimate the number of suckers gaining internet access born every minute? Or has cybercrime become the 'shark attack' that gets reported more often than it occurs?"

Ever notice how when there is a notorious crime reported suddenly lots of other similar crimes start happening? Well, they don't suddenly start, they were happening before, just not being reported. It isn't over or under reporting in the sense that our stats are wrong, only in the sense that the mass media does a shit job of conveying factual information to the public.

Defences are improving, people are getting more savvy. Obviously crime levels will go down. Back in 2002 XP didn't even have its firewall enabled by default. Everyone hated Vista for being locked down and hurling UAC prompts at the screen all the time, but it definitely worked.

There's absolutely no reason why IPv6 routers can't have a stateful firewall that blocks incoming connections by default. It's LESS difficult to do than NAT as there doesn't need to be packet inspection etc for things like FTP.

Indeed. My WRT54GL (running a customized version of TomatoUSB with IPv6 and an OpenVPN server) handles IPv6 in precisely that way, with DROP being the default.

For the few home IPv6-capable servers that I run that need incoming access from the IPv6 internet, the router's web interface allows one to open specific ports for specific IPv6 addresses. No NAT required, which is nice: I can have several servers running on the same port with no issues.

he router's web interface allows one to open specific ports for specific IPv6 addresses. No NAT required, which is nice: I can have several servers running on the same port with no issues.

The question I put back to that statement though: Since NAT is a pseudo-firewall for IPv4, applications running on computers leverage some IP trickery (NAT traversal techniques) or dynamically map ports via UPnP to achieve connectivity. Those techniques aren't the classical "allow X past firewall" setting though, they merely give the traffic somewhere to go instead of bouncing off of the router's TCP stack.

How does one achieve the connectivity that full IPv6 *should* have (but won't because the clients w

NAT by itself doesn't drop all incoming connections.If there is no firewalling an attacker with access to the adjacent network "outside" the NAT router can access the internal network (assuming knowledge of the internal IP addresses - which isn't that hard). This risk is normally quite low, compared to the risk of someone "out there" trying to get in.

But thinking they can't get in just because there's NAT and they're the other side of the world is not true. Hackers have been able to subvert ISP routers and

No it doesn't. NAT by default performs address translation. The stateful firewall drops incoming connections by default, NAT translates the permitted ones to a given address. There are consumer NAT boxes that include the concept of a 'default host' so any inbound traffic goes to that machine. There are others that include a firewall that drops inbound traffic.

The situation is more or less the same for IPv6. A firewall may default to not allowing any incoming connections, to only allowing incoming con

1 : the crimes were reported, as fraud, identity theft, etc... just not categorised as Cyber Crime...

2: People do more on-line now and so the crime that does happen costs them real money, not just inconvenience and so gets reported

Vista was rubbish at security, Microsoft finally woke up to the don't run as root model, then implemented it in a very visible way that annoyed the user into not reading the prompts... so they accepted everything (including the scumware..)

Win7 seems to have implemented it in the right way, ask when it's important, once, so it's unusual to see a prompt and so people actually read it...

With Windows 7, I concur that Microsoft did do it right, but it's not that it asks any less frequently per se, it's just that certain things are automatically elevated without a UAC prompt. There were some nifty little tricks that abused that at first, because rundll32.exe was one of the auto-elevated applications.

What was really obnoxious about UAC in Vista (that lead me to turn it off) was that even running MMC, by itself, would cause a prompt. This was annoying as all hell when you were launching it t

Microsoft finally woke up to the don't run as root model, then implemented it in a very visible way that annoyed the user into not reading the prompts... so they accepted everything (including the scumware..)

It was, unfortunately, necessary.

Back in the XP days legit software did a lot of bad things. Writing to the registry, shitting all over the filesystem, changing OS settings, installing drivers, making itself start at boot time and so forth. Microsoft could have just broken all that but then people would have been pissed off that none of their software worked. Instead they came up with UAC that annoyed the user in the hope that application developers would change their habits and try to avoid generating them

Depends on your definition of "computer savvy" - as we get more layers of UI people will generally have less and less of an idea what's going on, just look at how many people equate "windows" and "computer". People will hopefully become more resistant to social engineering approaches like phishing, but the use of a computer is almost coincidental, these types of scams have been going on since the telegraph system and probably before. Gullible people will always fall for something.

Fly-phishing: Phishing involving air travelSaltwater Phishing - Phishing from overseasWeekend Phishing - A leisure time activity that's used more as an excuse to drink beer than to scam peoplePhishing Boat - A scammer's base of operations located on a vessel in international watersPhishing Rod - Viagra scamsPhishing Line - Like a pick-up line, but for money instead of sex.

I work in a place that gets many calls related to phishing scams. You would not believe how many people argue with you on the legitness of the letter, they just don't understand why the money hasn't come to them yet. I don't believe in the past 5 years I've been here, the volume has decreased. Hasn't increased either, it tends to be steady every year.

My own parents were hit with a rental scam (even though I had told them always ask me first about anything fishy). It was hey we'll sign contract, here's money order, oh crap we sent you too much, can you send the difference back. Lost $500, but learned a lesson and changed how they do rental agreements as a result.

So 1 fish is out of the sea, but unfortunately with billions of people on the planet, there are plenty suckers out there. Also, many of these scams appeal to the get rich quick mentality of people. I mean how come other scams can keep working unless people have this need that "maybe this is the time this works and I can stop working or afford ".

To people thinking that every generation will get more computer savvy and this will go away, i tend to disagree. Just because a generation is tech savvy doesn't mean they won't fall for the temptation to make money quick, even if it does sound too good to be true.

Individual phishing events are the least of ones worries these days. Even if you're able to completely avoid fraud yourself, you're likely to have your account detailes exposed in a breach of a credit card processor.

Or I could just use my regular credit card, which gives me various perks (cash back, airline miles, etc.) with no service fees (unlikely the prepaid ones).

In the unlikely event that my card is misused I simply call the bank, dispute the charges, and get a new card in the mail. This has happened to me once or twice over the years (bad guy acquired card info without my knowledge) and I've spent less than 30 minutes total dealing with the fallout from such events.

Sure, I shouldn't have to deal with it at all in an ideal world, but dealing with the aftermath of credit card fraud is pretty much a non-issue from the side of the customer.

Laws regarding credit cards no doubt vary considerably internationally. In the US they're shockingly consumer-friendly. The burden of proof is basically on the merchant to demonstrate that the charge is legitimate. Until the dispute is resolved the charge has to be removed, you don't have to pay it, and you can't be charged interest on it either.

Every few months, there seems to be another story about how a hacker has stolen millions of credit card numbers, but you hear few stories about victims of these attacks. You think there should be a large class action lawsuit or something in the news.

It just seems like most of the time, security consultants are exaggerating these stories to sell their products.

There was a slashdot report recently about the average taking from a stolen card number in a recent breach being about $20. This probably makes sense. If you put three $7 transactions on a card over a six month period then most people will probably just ignore them and assume that they were things that they simply forgot about. Some people will complain, and the bank will just reverse the charge and make the merchant (you) eat the loss (not really a loss, because you didn't really provide a product in re

Completely off-topic, but the word you're looking for is "legitimacy". I'm no grammar nazi, and I'm not trying to troll or put you down either; You seem quite literate. I just wouldn't like to think that you'd put such a non-word into a term paper / official document by mistake.

It was hey we'll sign contract, here's money order, oh crap we sent you too much, can you send the difference back. Lost $500,

I think banks should be held responsible for that one.
I never got the money order to see, but from what I understand banks deposit the money order and credit it (not like a check that gets verified first) and then, 2 weeks later, the money is yanked from your account, because money order is fake.
If you bring cash, bank will test it. If you deposit a check, it will get confirmed before money is available. Why are money orders different??

So we need to fix the surveys! If you get asked about how much you lost to cybercrime, claim to be a cybercriminal and give negative numbers. "I made $2 million in my Nigerian Prince scam. Would you help me smuggle money out of my country before my usurper cousin recovers it?"

Over reported? Possibly. Is it still a problem that is a long way from being solved? Yes.

Just last week the university that I work at suffered a significant phishing attack that compromised a large number of email accounts (we don't have a complete count yet - the phisher turned around and used those accounts to send out spam and he didn't use all of them at one time). How did it work? Well, it wasn't very sophisticated - a dupe of our webmail login page (at a different URL) and an email that said "dear {university} account user...blah...account being locked...blah...go to this page {link to copy of page with fugly URL}...blah" from a Yahoo address. And the students (arguably an intelligent bunch, and most young enough to know how computers and phishers work) drank the kool-aid, clicked on the link and, in the end, made quite a mess.

I've actually been in the room when people have said "hey, this Nigerian prince thing looks like a good idea" . I've spoke with people who let a phone caller from "Microsoft" take control of their PC. And it comes from both sides. I've received legitimate emails from my bank that l could've sworn up and down were from a spammer (unsolicited, from someone I've never met, from a branch that I don't go to, poorly formatted and offering me a free credit card) but which were upon further review (checked the email address and the phone number provided in the email with the bank's fraud division) were legit. That irks me the most because it just encourages people to accept stuff that doesn't pass the smell test.

The more press this kind of thing gets the better. I'm not saying it should take headlines and mindspace from other, worthy causes but the fact is that people - including me - are stupid. If you don't hit us over the head every once in awhile to remind us why we ought not to do this than we probably will.

It is not just that we are a long way from solving the problem of computer crime; we are not even trying to solve it. We are still sluggish on deploying digital cash (no, not Bitcoin, more like Chaum), relying on traditional systems of banking that have been translated into electronic forms (debit cards, credit cards, PayPal, etc.). We are still relying on passwords to protect money, personal information, and so forth. We are still relying on the From: field in an email to determine who the email came from. When things go wrong, we just call up the police and do nothing to fix the inherent security problems that made the attack possible.

Is it any wonder computer crime remains a serious problem? Society has not yet adjusted its thinking to align with the computer age. People have no concept of how easily emails can be forged -- one of my favorite demos to give people is to send them an email that has their own email address in the "From" field. There is also a general lack of technical knowledge that creates problems for people; a friend once told me that by password-protecting her BIOS, she could ensure that a thief would not be able to read her hard drive (she was shocked when I made her aware that a thief could just remove her laptop's hard drive and insert it into a different computer).

Eventually society will catch up. People eventually learned that traditional sword fighting tactics need to be dropped when you are dealing with firearms. In a few decades, computer security will improve out of necessity. Unfortunately, the time between now and then will be painful.

How does digital cash solve the Nigerian scam problem?How does digital cash solve the problem of using a user's credentials to transfer money out?Which common computer crime problems does digital cash solve?

You know how you get this funny feeling about giving your credit card details to some unknown website, or over an unsecure connection, or to some stranger at a gas station? The reason you get that funny feeling is that you are worried that the person you just gave that information to might turn around and spend your money, a basic form of online credit card fraud. It happens all the time, and that information is one of the things that is traded on "carder" forums. Now we have an even worse problem: well known businesses might be attacked, and have databases full of payment information copied.

Now, a digital cash smart card is another story. You have a card with enough memory to store some digital cash tokens and some circuitry for carrying out a digital cash protocol. You want to buy something online? Plug your smartcard into your computer (why don't we ship computers with smartcard readers?), make the payment, and the worst that can happen is that the counterparty never delivers what you purchased. No fears about your credentials being used to make fraudulent payments, no worries about a database of payment information, and your money can only be stolen the traditional way: someone taking your smartcard from your wallet.

This was one of the original points of digital cash. Anonymous payments are not good because they let you evade government regulations, they are good because they do not create identity theft problems. Digital cash is good because it is anonymous, and because it is hard (in a cryptographic sense) to make fraudulent payments without at least betraying your identity in the process (and thus opening yourself up to prosecution).

I am not going to claim that all financial crime problems will be solved with digital cash. People will still need to transfer cash to their smartcards somehow, which is something that also needs to be secured. The point here is that we could defend ourselves from a large and important class of computer crimes by deploying relatively inexpensive hardware (a one-time cost) and some well-developed cryptographic protocols.

I recently got to play with a new prototype credit card. It's pretty neat, there is a small LCD and a button built into the card, as well as a NFC transceiver. You put it near your phone or computer and it displays the transaction amount on the card's screen. You press the button and it authorises it, by sending a single-use token to the computer. If your computer is trojaned then it can only be used to steal amounts equal to those of purchases you make (but altering the payee ID, although the next vers

No, I don't get that funny feeling at all. Because with credit cards it's not my money - it's a CREDIT card after all! If there's card fraud it's usually the merchant's (or more rarely the bank's) money that's gone. And if the merchant doesn't deliver, I complain to my card issuer, and I don't have to pay for that transaction. It may take a while for some cases but meanwhile the scenario is: my money is with me, the bank says I owe them. It's in the interest of the bank to fix the situation. I can complain

I've spoke with people who let a phone caller from "Microsoft" take control of their PC.

Fair do's here... this con has always been quite convincing, you are after all talking to a real person
and they know your computer is running slow, so they must be on the level and there getting better and better scripts .

The first ones I got were pretty crude where they make a non-specific allegation that "We are calling on
behalf of your ISP and they say..." more recently they have talked me through opening up my Event Viewer so I could see
all the scary warnings and errors to be told 'ohhh its wors

I've spoke with people who let a phone caller from "Microsoft" take control of their PC.

I've had 2-3 of these a year for the last few years and I try and string them along as long as possible as a service tosociety... Its great fun, but don't try and buy time by saying you have to switch your computer on, they just ring off:-(

Well, if you think about it, someone who doesn't leave their computer on all the time is a less desirable target for data harvesters or trojan/botnet admins. The more someone uses their computer to manage more parts of their life (and therefore have more sensitive data stored there) the more likely they are to leave it on all the time, for later rooted perusal, DDOS zombie use, etc.

I've received legitimate emails from my bank that l could've sworn up and down were from a spammer (unsolicited, from someone I've never met, from a branch that I don't go to, poorly formatted and offering me a free credit card) but which were upon further review (checked the email address and the phone number provided in the email with the bank's fraud division) were legit.

I'm surprised you actually went that far, and didn't delete the mail instantly. That's what I do with such mails. From my bank I only expect automatic incoming remittance notifications; anything else that appears to be from my bank or any other bank gets deleted without even reading the body.

Most of them go to my spam folder or get filtered into another folder that is not spam but might as well be for the number of times I look there. When one gets past that gauntlet I naturally want to find out how it did so and where my rules might need tuning. Because I thought it was fraud I started collecting info from the email to send to my bank's fraud division (as long as I was reading the email anyway) and it rolled from there.

On the surface it appears to be nothing more than a hassle for my department. To a point that's fine - that's what our department is paid to do. However there is an opportunity cost there - the time we spend cleaning up the mess is time we could have spent elsewhere. There's also cost to the students, staff and alumni involved in the attack (yes, we provide email to all three groups) - students and staff dislike the policy we have of making them prostrate themselves before our department to ask that they

I believe your claim that this particular phishing attack has had negative effects on various people. What I don't believe is that (1) this has anything to do with the article linked to from the slashdot summary, or (2) that these negative effects are in any way quantifiable (which is basically the point of the article). The problems you're citing are like broken windows, graffiti, or finding used condoms in your front yard when you go out to get the morning paper; they're a bummer, but they're not quantifi

If you are a member of a non-profit that exists to educate and information about specific harm X, you should make sure to inflate your figures so that it seems there's a Biblical plague of X out there. Job security is guaranteed this way. If you just leave it up to X to manifest itself, you could be out of a job real quick. The biggest user of this theory is government itself, which is going to invent waves of drug dealers, Nazis, terrorists, fundamentalists, pedophiles and corporate men in black in order t

Seem to assume the only way to cancel out an over-estimation is someone reporting a negative loss. Not sure why, Respondent A reporting $10k when his loss was really $5k could be canceled by Respondent B who lost $5k but was too embarrassed to say so.

How do we reconcile this view with stories that cybercrime rivals the global drug trade in size? One recent estimate placed annual direct consumer losses at $114 billion worldwide. It turns out, however, that such widely circulated cybercrime estimates are generated using absurdly bad statistical methods, making them wholly unreliable.

Having dug into some of the statistics publicized for the drug war, I would say that merely having "absurdly bad statistical methods" could be an improvement. In the drug war, statistics are frequently more or less made up. Remember, the people funding this research have a vested interest and a strong desire to have the numbers come out the way they want them to and, no surprise, they generally do. There are whole institutes, such as the Center on Addiction and Substance Abuse at Columbia University, whose statistics I regard as consistently untrustworthy.

I would not be too surprised to see the same dynamic, and even the same people, involved in the cybercrime statistics game.

Remember, the people funding this research have a vested interest and a strong desire to have the numbers come out the way they want them to and, no surprise, they generally do.

Yep. I worked on a cybercrime startup idea for a while, and every single "cost of cybercrime" calculation I found - even from government agencies - was based on the same estimate from MarkMonitor. After a few years, MM was able to cite the more "official" sources with a circular reference.